Question on no data in index "no results found"

[jiaqya]

I have 2 situations to address..
1. if no data in index for timeframe , create a blank row with "no data" and come out of query
2. if data found, then eval next steps , if result is 0 , then create a blank row with "0" as data.

can both of these be achieved in a single query.
basically search index for data, if data not found, create "nodata" row, exit,
else if data found, but no results on eval, then create "0" row ...

hope i am clear with my question.

[richgalloway · Accepted solution]

There is no concept of "come out of query" in SPL. All queries run to the end.

To add "no data" to your query, use appendpipe near the end.

... | appendpipe [ stats count | eval foo="no data" | where count = 0 | fields - count ]

[jiaqya]

i saw the append pipe fix , but was wondering if anybody knew any other trick to get this working..
this fix helps me get things going...

i wish , if then else statements worked with spl the same way they work in other languages..

thanks..

[richgalloway]

Go to https://ideas.splunk.com to submit a feature request.